Attackers used the Hermes AI agent to automate post-exploitation activities against Thailand’s Ministry of Finance, marking one of the first documented cases of an AI agent being weaponized in a real-world state-targeted cyberattack.
Security researchers at Hunt.io discovered the artifacts on a compromised C2 server. The operator installed Hermes Agent (by Nous Research), switched off its safety guardrails, and let it run unattended against the ministry’s network. The server also hosted a previously unreported Go implant called “Hades” used for persistence and lateral movement.
YOLO mode and what it means
The Hermes agent was running in what the researchers call “YOLO mode” (You Only Live Once). In its normal configuration, Hermes asks the operator for confirmation before executing risky commands like file writes, network connections, or privilege escalation. The attacker disabled those approval prompts, effectively telling the agent: execute anything required to achieve the objective.
This is the security equivalent of removing the safety from a power tool. The agent is designed to be useful for legitimate tasks: code generation, system administration, security analysis. But when the guardrails are off, the same capabilities that make it productive for sysadmins also make it effective for attackers. The agent does not need to be jailbroken or exploited. It just needs the approval gates opened.
The Hunt.io report noted that Hermes log files on the server showed the agent autonomously executing commands across multiple stages of the attack lifecycle including reconnaissance, credential access, and lateral movement preparation. The logs did not show the agent reaching a ministry machine with the Hades implant, but the overall infrastructure indicated an active intrusion campaign.
A cross-platform implant delivery setup
Alongside the Hermes agent, the attackers deployed an implant they called “Hades” written in Go. The C2 server served as a cross-platform implant delivery hub, hosting 62 variants of the Hades payload across a directory structure organized by operating system and architecture. The directory structure was intentionally designed. Each combination of OS and architecture had its own directory under a root folder on port 8080.
The Go implant handled persistence, beaconing, and command execution. The operators used webshells and active session cookies to maintain access to compromised systems inside the ministry’s network. Hunt.io assessed with moderate confidence that the attackers operated out of China based on infrastructure patterns and working hours observed in the C2 logs.
What this changes
Security researchers have been warning about AI-powered attacks for a while. But most of those warnings were about using LLMs to write better phishing emails or generate malware code faster. This is different. The Hermes agent was not just assisting a human attacker. It was operating autonomously as a post-exploitation engine, making decisions about which commands to run based on the environment it found itself in.
The agent’s ability to adapt to the target environment in real time is what makes this significant. Traditional automated attack tools follow a fixed playbook. An AI agent can read error messages, try different approaches, and adjust its strategy based on what works. That flexibility makes it harder to detect with signature-based tools.
For defenders, the implications are uncomfortable. The same open source AI agent tools that security teams use for red teaming and incident response can be co-opted by attackers with minimal modification. The attack surface is not a vulnerability in the agent itself. It is that the agent works as designed, and the design includes the ability to operate autonomously when the operator chooses to let it.
Comparing with traditional post-exploitation tools
Traditional post-exploitation frameworks like Cobalt Strike, Metasploit, and Empire operate on a command-and-control model. The attacker writes modules, stages them on the target, and executes them one at a time. Each step requires planning and manual intervention. The AI agent approach replaces that with a goal-oriented model. Instead of “run mimikatz, then check output, then decide next step,” the operator tells the agent “escalate privileges and dump credentials” and lets it figure out the steps.
The tradeoff is control. A C2 framework gives the operator precise control over every command. An AI agent makes its own decisions about which tools to use and when. The agent might try a technique the operator did not intend, leave evidence the operator did not expect, or fail in ways that are harder to debug because the reasoning chain is opaque.
This is not an academic distinction. The Hunt.io report noted that the Hermes agent left extensive logs on the C2 server, including the full reasoning trace behind each command. For a careful operator, that is a liability. The logs reveal TTPs, targeting priorities, and infrastructure. For defenders, those same logs are intelligence gold. If you can find the C2 infrastructure, you can reconstruct the entire attack sequence.
Practical takeaways for security teams
Monitor for AI agent deployment on your network. Hermes and similar agents (Claude Code, Codex CLI, open source alternatives) leave traces: configuration files, model downloads, process activity. If you see one running in a context where nobody should be using it, that warrants investigation.
Review your EDR and SIEM rules for agent-specific indicators. The Hermes agent makes HTTP calls to API endpoints, writes output files, and executes shell commands. These can be detected with behavioral rules that look for the pattern: a process that reads from stdin, makes outbound API calls to LLM providers, and executes the resulting commands on the host.
And consider the broader implication: the threshold for conducting a sophisticated, multi-stage cyberattack keeps dropping. Tools that were designed for developer productivity are now being repurposed for offensive operations. The same open source agent that helps you write deployment scripts can, in the wrong hands and with guardrails off, help someone infiltrate a government ministry.